Remote malware remediation

• US 9,667,648 B2
• Filed: 09/14/2015
• Issued: 05/30/2017
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Teddy, John, Bean, James Douglas, Dalcher, Gregory William, Hetzler, Jeff
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): KAPLAN, BENJAMIN A
• Application Number:
  US14/853,870
• Publication Number:
  US 20160006751A1
• Time in Patent Office: 624 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An opportunity to assist with remediation of a file at a remote particular host device is identified. One or more remediation techniques are identified that can be applied to assist with remediation of the file at the particular host device. In one aspect, one or more remediation scripts are identified from a plurality of remediation scripts for remediation of the file and provided to the particular host device for execution on the particular host device. In another aspect, a remediation tool is identified and launched on a computing device remote from the particular host device with operations of the remediation tool applied to resources of the particular host device. In another aspect, at least a portion of the remediation techniques are remotely initiated to be performed locally at the particular host device.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify, at an anti-malware support system, an opportunity to assist with remediation of a file at a particular host device remote from the anti-malware support system;

determine a remediation tool for remediation of the file;

launch the remediation tool on a computing device remote from the particular host device;

cause operations of the remediation tool to be applied to resources of the particular host device; and

receive feedback data at the anti-malware support system from the particular host device identifying whether the operations of the remediation tool remediated the file, wherein feedback data identifying that remediation of the file is incomplete following application of the operations causes the anti-malware support system to apply another remediation tool to resources of the particular host device.

2. The storage medium of claim 1, wherein causing the operations to be applied to resources of the particular host device includes redirecting the operations to act on the resources of the particular host device.

3. The storage medium of claim 2, wherein the resources include at least one of a memory block, file, or register of the particular host device.

4. The storage medium of claim 2, wherein the operations are redirected through an agent on the particular host device.

5. The storage medium of claim 1, wherein the remediation tool is a first remediation tool and the other remediation tool comprises a second remediation tool.

6. The storage medium of claim 5, wherein the first and second remediation tools are defined to be run in series.

7. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to provide the file to the remediation tool.

8. The storage medium of claim 1, wherein the remediation tool is executed in a virtual environment.

9. The storage medium of claim 1, wherein determining whether to use the remediation tool in response to a subsequent opportunity to remediate the file is based at least in part on the feedback data.

10. The storage medium of claim 1, wherein the remediation tool is at least one of an anti-virus tool, an anti-spyware tool, and an antirootkit tool.

11. The storage medium of claim 1, wherein applying the operations of the remediation tool to the resources remediates the file from the particular host device.

12. The storage medium of claim 1, wherein the opportunity is identified based on a query from the particular host device for additional reputation information for the file.

13. The storage medium of claim 12, wherein the query prompts a determination by an antimalware support system remote from the particular host device that the file should be remediated.

14. The storage medium of claim 1, wherein identifying the opportunity includes receiving a request for remediation of the file from the host device.

15. The storage medium of claim 14, wherein the request for remediation is based on a determination at the host device that the file should be remediated.

16. The storage medium of claim 15, wherein the determination of the host device is in response to receiving reputation information for the file from an antimalware support system remote from the particular host device.

17. The storage medium of claim 16, wherein the instructions, when executed, further cause the machine to:

receive a query from the particular host device; and

return response data including the reputation information in response to the query.

18. The storage medium of claim 1, wherein the remediation tool is to be executed by the computing device.

19. The storage medium of claim 18, wherein the remediation tool comprises a first remediation tool, and the instructions, when executed, further cause the machine to:

identify an opportunity to assist with remediation of the file at a remote second host device;

determine a second remediation tool for remediation of the file on the second host device, wherein the second remediation tool is different from the first remediation tool;

launch the second remediation tool on a computing device remote from the second host device; and

cause operations of the second remediation tool to be applied to resources of the second host device to remediate the file.

20. The storage medium of claim 18, wherein the file comprises a first file, the remediation tool comprises a first remediation tool, and the instructions, when executed, further cause the machine to:

identify an opportunity to assist with remediation of a second file at the particular host device;

determine a second remediation tool for remediation of the second file, wherein the second remediation tool is different from the first remediation tool;

launch the second remediation tool on a computing device remote from the particular host device; and

cause operations of the second remediation tool to be applied to resources of the particular host device to remediate the second file.

21. A method comprising:

identifying, at an anti-malware support system, an opportunity to assist with remediation of a file at a particular host device remote from the anti-malware support system;

determining a remediation tool for remediation of the file;

launching the remediation tool on a computing device remote from the particular host device;

causing operations of the remediation tool to be applied to resources of the particular host device; and

receiving feedback data at the anti-malware support system from the particular host device identifying whether the operations of the remediation tool remediated the file, wherein feedback data identifying that remediation of the file is incomplete following application of the operations causes the anti-malware support system to apply another remediation tool to resources of the particular host device.

22. A system comprising:

at least one processor device;

at least one memory element; and

an antimalware support server adapted when executed by the at least one processor device to;

identify an opportunity to assist with remediation of a file at a remote particular host device;

determine a remediation tool for remediation of the file;

launch the remediation tool on a computing device remote from the particular host device;

cause operations of the remediation tool to be applied to resources of the particular host device; and

receive feedback data at the anti-malware support system from the particular host device identifying whether the operations of the remediation tool remediated the file, wherein feedback data identifying that remediation of the file is incomplete following application of the operations causes the anti-malware support system to apply another remediation tool to resources of the particular host device.